Missing Authorization in OpenEMR Allows Billing Note Tampering

Executive Summary

This is a missing authorization vulnerability in OpenEMR versions before 8.3.0. It exists in the file interface/billing/sl_eob_patient_note.php and allows any authenticated user, including low-privilege accounts, to read and modify patient billing notes without proper access controls. Attackers can exploit this by guessing patient IDs and submitting POST requests with a CSRF token to access or tamper with sensitive billing data.

Useful 0 Not Useful 0

Detection Guidance

Check OpenEMR versions prior to 8.3.0 for the vulnerable file interface/billing/sl_eob_patient_note.php. Monitor for unauthorized POST requests to this endpoint with patient_id parameters. Look for unusual access patterns or modifications to billing notes by low-privilege users.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to unauthorized access to confidential billing data, including financial and protected health information. Attackers with low-privilege accounts can read or modify patient billing notes, potentially causing financial fraud or data breaches. The impact includes compromised patient privacy and integrity of billing records.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability can violate compliance with GDPR and HIPAA by exposing protected health information (PHI) and financial data without authorization. GDPR requires strict access controls for personal data, while HIPAA mandates safeguards for PHI. Unauthorized access or modification of billing notes can result in legal penalties and reputational damage.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade OpenEMR to version 8.3.0 or later. Implement access control list (ACL) checks in sl_eob_patient_note.php to restrict access based on user roles. Apply patient visibility filters to prevent unauthorized data access. Review and audit billing note modifications for suspicious activity.

Useful 0 Not Useful 0